Selectively performing man in the middle decryption

• US 9,148,407 B2
• Filed: 04/08/2015
• Issued: 09/29/2015
• Est. Priority Date: 05/08/2013
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: iBoss
• Inventors: Martini, Paul Michael
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US14/682,019
• Publication Number:
  US 20150215286A1
• Time in Patent Office: 174 Days
• Field of Search: 713150-151, 713164-168, 726 1- 4, 726 12- 22
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

An agent on a device within a network receives a request to access a resource outside the network. A first encrypted connection is established between the device and the agent, and a second encrypted connection is established between the agent and the resource, to facilitate encrypted communication traffic between the device and the resource. The agent sends a policy request to a network appliance within the network, the request specifying the resource. The agent receives a policy response indicating that the resource is associated with one or more security policies of the network. Traffic passing between the device and the resource is selectively decrypted and inspected depending on the security policies.

Claims

1. A method performed by data processing apparatus, the method comprising:

receiving, by an agent on a device within a network, a request to access a resource outside the network;

establishing, by the agent, a first encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a second encrypted connection between the agent and the resource such that the agent is configured to act as a proxy of the device to the resource;

sending, by the agent in response to receiving the request to access the resource, a policy request to a network appliance within the network, the request specifying the resource;

receiving, by the agent and from the network appliance, a policy response indicating that the resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource, depending on the security policies;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the resource and address to the device, depending on the security policies;

receiving, by the agent, a second request to access a second resource outside the network;

determining that the second resource is on a whitelist that lists resources for which man-in-the-middle analysis should not apply; and

causing the establishment, responsive to determining that the second resource is on the whitelist, a third encrypted connection between the device and the second resource to facilitate encrypted communication traffic between the device and the second resource;

wherein the first, the second, and the third encrypted connections are separate and have different formats.

2. The method of claim 1, wherein the device and the network appliance are subject to the same administrative control.

3. The method of claim 1, wherein inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource includes blocking encrypted communication traffic from the device and addressed to the resource.

4. The method of claim 1, wherein the request to access the resource is a Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) GET or POST request.

5. The method of claim 1, the method further comprising:

removing the device from the network;

receiving, by the agent, a third request to access a third resource outside the network;

establishing, by the agent, a fourth encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a fifth encrypted connection between the agent and the third resource such that the agent is configured to act as a proxy of the device to the third resource;

sending, by the agent in response to receiving the third request to access the resource, a third policy request to the network appliance, the request specifying the third resource;

receiving, by the agent and from the network appliance, a third policy response indicating that the third resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the third resource, depending on the security policies; and

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the third resource and address to the device, depending on the security policies.

6. The method of claim 1, wherein the agent is a driver installed in a protocol stack of the device.

7. The method of claim 1, wherein the agent is configured to receive requests to access resources from a plurality of applications of the device.

8. A non-transitory computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operations comprising:

receiving, by an agent on a device within a network, a request to access a resource outside the network;

establishing, by the agent, a first encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a second encrypted connection between the agent and the resource such that the agent is configured to act as a proxy of the device to the resource;

sending, by the agent in response to receiving the request to access the resource, a policy request to a network appliance within the network, the request specifying the resource;

receiving, by the agent and from the network appliance, a policy response indicating that the resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource, depending on the security policies;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the resource and address to the device, depending on the security policies;

receiving, by the agent, a second request to access a second resource outside the network;

determining that the second resource is on a whitelist that lists resources for which man-in-the-middle analysis should not apply; and

causing the establishment, responsive to determining that the second resource is on the whitelist, a third encrypted connection between the device and the second resource to facilitate encrypted communication traffic between the device and the second resource;

wherein the first, the second, and the third encrypted connections are separate and have different formats.

9. The computer storage media of claim 8, wherein the device and the network appliance are subject to the same administrative control.

10. The computer storage media of claim 8, wherein inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource includes blocking encrypted communication traffic from the device and addressed to the resource.

11. The computer storage media of claim 8, wherein the request to access the resource is a Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) GET or POST request.

12. The computer storage media of claim 8, the operations further comprising:

removing the device from the network;

receiving, by the agent, a third request to access a third resource outside the network;

establishing, by the agent, a fourth encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a fifth encrypted connection between the agent and the third resource such that the agent is configured to act as a proxy of the device to the third resource;

sending, by the agent in response to receiving the third request to access the resource, a third policy request to the network appliance, the request specifying the third resource;

receiving, by the agent and from the network appliance, a third policy response indicating that the third resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the third resource, depending on the security policies; and

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the third resource and address to the device, depending on the security policies.

13. The computer storage media of claim 8, wherein the agent is a driver installed in a protocol stack of the device.

14. The computer storage media of claim 8, wherein the agent is configured to receive requests to access resources from a plurality of applications of the device.

15. A system comprising:

one or more processors configured to execute computer program instructions; and

non-transitory computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operations comprising;

receiving, by an agent on a device within a network, a request to access a resource outside the network;

establishing, by the agent, a first encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a second encrypted connection between the agent and the resource such that the agent is configured to act as a proxy of the device to the resource;

sending, by the agent in response to receiving the request to access the resource, a policy request to a network appliance within the network, the request specifying the resource;

receiving, by the agent and from the network appliance, a policy response indicating that the resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource, depending on the security policies;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the resource and address to the device, depending on the security policies;

receiving, by the agent, a second request to access a second resource outside the network;

determining that the second resource is on a whitelist that lists resources for which man-in-the-middle analysis should not apply; and

causing the establishment, responsive to determining that the second resource is on the whitelist, a third encrypted connection between the device and the second resource to facilitate encrypted communication traffic between the device and the second resource;

wherein the first, the second, and the third encrypted connections are separate and have different formats.

16. The system of claim 15, wherein the device and the network appliance are subject to the same administrative control.

17. The system of claim 15, wherein inspecting, by the agent, encrypted communication traffic from the device and addressed to the resource includes blocking encrypted communication traffic from the device and addressed to the resource.

18. The system of claim 15, wherein the request to access the resource is a Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS) GET or POST request.

19. The system of claim 15, wherein the operations further comprising:

removing the device from the network;

receiving, by the agent, a third request to access a third resource outside the network;

establishing, by the agent, a fourth encrypted connection between the device and the agent such that the agent is configured to act as a proxy of the resource to the device;

establishing, by the agent, a fifth encrypted connection between the agent and the third resource such that the agent is configured to act as a proxy of the device to the third resource;

sending, by the agent in response to receiving the third request to access the resource, a third policy request to the network appliance, the request specifying the third resource;

receiving, by the agent and from the network appliance, a third policy response indicating that the third resource is associated with one or more security policies of the network;

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the device and addressed to the third resource, depending on the security policies; and

decrypting and selectively inspecting, by the agent, encrypted communication traffic from the third resource and address to the device, depending on the security policies.

20. The system of claim 15, wherein the agent is a driver installed in a protocol stack of the device.

21. The system of claim 15, wherein the agent is configured to receive requests to access resources from a plurality of applications of the device.